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Introduction 

The original purpose of this project was to learn 
some methods in graph theory and then apply them 
to the study of network reliability. The project pro- 
ceeded far enough to produce some original material 
in two areas. The first area is the extensive study 
of braided networks, which includes a comparison of 
braided networks and double-ring networks. These 
two types of networks are described in later sections. 
The second area is a study of link redundancy versus 
path redundancy as a means of achieving reliability. 
These two concepts are also explained later. 

In response to the increased usage of distributed 
computer systems, interest in network analysis tech- 
niques has greatly expanded. In a fault-tolerant 
network, interest is often focused on maintaining an 
operational path between each pair of nodes in the 
network, that is, ensuring that all nodes are con- 
nected, despite failure of some of the connecting 
links. The probability that a network is connected is 
known as all-terminal reliability, which is equivalent 
to finding the probability that the network contains 
at least one minimal spanning tree. 

The important role that networks play in fault- 
tolerant systems mandates that techniques and tools 
be developed to aid in the analysis process. However, 
the development of effective and efficient techniques 
is hindered by the inherent computational difficulty 
in solving network problems. In fact, Ball has shown 
that network reliability problems are at least as diffi- 
cult to solve as computationally hard, NP-Complete 
problems such as the famous traveling salesman prob- 
lem (ref. 1). Consequently, most available analysis 
techniques primarily consist of approximation and 
bounding methods. 

Presented in this paper are some basic combina- 
torial techniques from graph theory that are useful 
in the reliability analysis of networks. The basic as- 
sumption throughout this study is that a network 
is fully operational as long as it remains connected, 
and, the purpose of applying elementary techniques 
is simply to consider the concept of connectivity un- 
encumbered by sophisticated mathematical methods 
and the special characteristics of individual systems. 
The methods presented are exact with the excep- 
tion of approximations used in solving fault trees. 
That is, the formulas for the probability of network 
failure use no approximations. All the techniques 
used are standard procedures which can be found 
in textbooks (Swamy and Thulasiraman (ref. 2), 
Christofides (ref. 3), and Prather (ref. 4)). 

Given a set of nodes and links, a variety of ar- 
chitectures can be configured. Although the same 


number of nodes and links are used, certain configu 
rations can tolerate more link failures while preserv- 
ing connectivity; hence, different architectures can 
have different reliabilities. The methods presented 
in this paper allow comparisons based on reliability 
to be made among different architectures. The study 
concentrates on the comparison of two distinct net- 
work architectures, the double-ring network and the 
braided network. The ring architectures are popular, 
and the braided network has local interest at Langley 
Research Center. 

In the next section, the combinatorial approach 
to computing the reliability of networks is described. 
First, limitations of combinatorial methods are pre- 
sented, followed by a discussion of minimal spanning 
trees and of the fact that, in general, reliability is not 
directly related to the number of minimal spanning 
trees in a network. The use of a fault tree program 
to compute the reliability of networks by means of 
minimal spanning trees is also discussed. 

The next four sections cover the work performed. 
There is a comparison of double-ring and braided 
networks where only the links fail, followed by a 
comparison of the two configurations where both 
links and nodes fail. Also dealt with are directed 
links (where each link can only carry a message one 
direction) and links that fail in a faulty manner as 
opposed to being either operative or inoperative. In 
this case, a failed link transmits incorrect messages, 
and system survival depends on each node being 
connected by a majority of good links. The final 
section gives some concluding observations. 

Synopsis of Combinatorial Methods 

As mentioned in the introduction, developing effi- 
cient algorithms for solving network reliability prob- 
lems has been proven difficult. A well-known dis- 
advantage to using exact combinatorial methods for 
computing the reliability of networks is that the com- 
putational burden increases dramatically with the 
size of the network and quickly overwhelms even the 
most generous computational resources. Neverthe- 
less, developing these exact methods has value. Many 
existing approximation methods must still consider 
the connectedness of the network, and exact methods 
have produced useful algorithms for determining con- 
nectedness. Other mathematical techniques, such as 
partitioning and conditional probabilities, originally 
used for exact solutions, might also be adapted for 
use in the more sophisticated approximation meth- 
ods. Moreover, performing the simple calculations on 
modest networks gives the analyst a feeling for the 


problem along with an appreciation for the difficulty 
in solving it. 

Limitations 

The methods considered in this study assume that 
a network survives or remains operational as long as 
there are enough good components to remain con- 
nected. This definition naturally lends itself to study 
by combinatorial methods. This paper first examines 
networks that experience link failures but no node 
failures and then deals with models that include both 
node and link failures. These models allow networks 
to survive the failure of a large number of compo- 
nents. In reality, the decision algorithms of an oper- 
ating system are likely to break down after only a few 
components have failed since there may be too much 
overhead used in storing and running decision algo- 
rithms that can handle all the contingencies associ- 
ated with numerous failures. Within this context, the 
reliability results presented in this paper are likely to 
be optimistic; yet, valid, qualitative comparisons can 
still be made between real-world network architec- 
tures like the double-ring and braided networks. 

The reliability aspect of the network problem is 
considered without regard for performance issues. 
Consequently, a network that appears highly reliable 
might have to be rejected, in practice, because its 
complex topology does not permit efficient routing 
algorithms. There are also some disadvantages inher- 
ent in using combinatorial methods (either exact or 
approximate) for computing system reliability. Com- 
binatorial methods cannot capture the dynamic fea- 
tures of a system, so there can be no consideration 
of fault latency or path-regrowing time. Combina- 
torial methods also underestimate the probability of 
system failure because they do not take into account 
the problems created by the time lag of a system rec- 
ognizing and replacing failed components. Neverthe- 
less, combinatorial methods provide a means of mak- 
ing some important observations about basic network 
reliability. 

Minimal Spanning Trees 

The concept of minimal spanning trees is funda- 
mental to the study of connectedness. For a given 
graph, a minimal spanning tree is a subset of the 
links that allows all nodes in the graph to be con- 
nected, with the property that no subset of the min- 
imal spanning tree’s links exists that forms a con- 
nected graph. That is, failure of any single link in 
the minimal spanning tree means that set of links no 
longer constitutes a minimal spanning tree, i.e., it is 
no longer possible to reach every node in the graph. 
Given a graph with n nodes, each minimal spanning 


tree for that graph will have (n — 1) links. Figure 1 
is an example of a simple network; figure 2 depicts 
the set of all minimal spanning trees for the network 
in figure 1. 



Figure 1. A simple network with bidirectional links. 



Figure 2. The set of minimal spanning trees for the network 
in figure 1. 


The important concept to remember is that as 
long as all the links making up at least one of the 
minimal spanning trees remain operational, the net- 
work is connected and, hence, assumed operational. 
Thus, the probability that the network fails is equiv- 
alent to the probability that no operational minimal 
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spanning tree exists. Theoretically, then, computing 
the reliability of a network is quite simple. However, 
even for networks with very few nodes (<10), the 
number of spanning trees can be very large, which 
makes storing the trees and finding the probability 
that no operational spanning trees exists a computa- 
tionally demanding task. 

The number of minimal spanning trees for a net- 
work can be computed without actually generating 
the list of trees (ref. 3). Figure 3 shows a double-ring, 
a two-braid, and a three-braid network. In the two- 
braid network, the inner links connect every second 
node instead of adjacent nodes. In the three-braid 
network the inner links connect every third node. 



(a) Double ring. 




(c) Three braid. 

Figure 3. Three network configurations considered in present 
paper. 

Table I contains the number of minimal spanning 
trees for each of the configurations above as the 
number of nodes varies from 5 to 11. 


Table I. Number of Minimal Spanning Trees for Double-Ring, 
Two-Braid, and Three-Braid Network Configurations 


Number of nodes 

Number of minimal spanning trees 

Double ring 

Two braid 

Three braid 

5 

80 

125 


6 

192 

384 


7 

448 

1 183 

1 183 

8 

1 024 

3 528 

4 096 

9 

2 304 

10 404 

12 321 

10 

5 120 

30 250 

40 500 

11 

11 264 

87 131 

130 691 


Although two networks have equal numbers of 
nodes and links, the links can be arranged in a variety 
of architectures such that the two networks have 
different numbers of minimal spanning trees, as in 
figures 4 and 5. Since only one minimal spanning 
tree must remain intact in order for a network to 
be connected, it seems logical to assume that the 
network with the larger number of minimal spanning 
trees will be the more reliable of the two. Network 
reliability would appear to be proportional to the 
number of spanning trees. 



Figure 4. A network with 16 minimal spanning trees. 



Figure 5. A network with 13 minimal spanning trees. 
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The network in figure 4 has 16 minimal spanning 
trees and the network in figure 5 has 13 minimal 
spanning trees. Based on the number of spanning 
trees, it would appear that the network in figure 4 is 
more reliable than the network in figure 5. However, 
a single link failure, failure of link 1, will isolate a 
node in figure 4 whereas it takes failure of at least 
two links to isolate a node in figure 5. Thus, the 
network in figure 5 is more reliable than the network 
in figure 4 since its cutset (the number of links it 
takes to isolate a node) is larger than the cutset 
of the network in figure 4. Computations reveal 
that when the probability of link failure is 10 ~ 2 the 
probability of failure for the network in figure 4 is 
1.0004 x 1CP 2 and the probability of failure for the 
network in figure 5 is 5.9206 x 10 -4 . 

Therefore, network reliability comparisons cannot 
be made based on the number of minimal spanning 
trees. A monotonic relationship between reliability 
and the number of minimal spanning trees may hold 
for symmetric networks, examples of which will be 
discussed later, but there is no proven result about 
a general monotonic relationship. This counter- 
example is unfortunate since the method of comput- 
ing the number of minimal spanning trees is easy, 
while obtaining all the minimal spanning trees is 
difficult. 

Fault Trees 

As discussed earlier, computing the probability 
that no minimal spanning tree will survive is equiv- 
alent to computing the probability that the network 
will fail. That is, given the complete list of mini- 
mal spanning trees for a network and the probability 
of failure for each link in the network, combinatorial 
methods can be applied to compute the probability 
of network failure. Fault tree analysis is a conve- 
nient method for computing combinatorial probabil- 
ities. To demonstrate the role of fault trees in com- 
puting network reliability, consider the example of 
figure 6. 



Figure 6. Fault tree to compute the probability of network 
failure for the network depicted in figure 1. 


Figure 6 shows the fault tree for computing the 
probability of failure of the network shown in figure 1. 
The basic events, 1, 2, 3, 4, and 5, represent failures 
of the individual links. Each OR gate corresponds to 
a minimal spanning tree. Failure of one of the inputs 
to an OR gate eliminates the associated spanning tree 
as a possibility for preserving network connectivity. 
The top gate, representing network failure, is an 
AND gate since the network is not connected if all 
the minimal spanning trees are eliminated. 

Even for this small example, manually calculating 
the probability of the top event is tedious. And, 
as seen in table I, the number of spanning trees 
in a modest size network can be extremely large, 
which would make manual calculation of reliability 
infeasible. Fortunately, computer programs have 
been created to effectively perform fault tree analysis. 
The Fault Tree Compiler program, developed at 
Langley Research Center by Butler and Martensen 
(ref. 5), employs an efficient algorithm for solving 
fault trees and is used throughout this study to 
provide numerical results. 

Reliability When Bidirectional 
Links Fail 

A common assumption in network analysis is that 
the links are subject to random failure and that the 
nodes do not fail. From a practical viewpoint, con- 
sidering only link failure implies that all processing 
elements (nodes) in a network are functional but the 
communication channels (links) between those pro- 
cessing elements are subject to failure. A bidirec- 
tional link allows communication to flow between two 
nodes in either direction. Failure of the links was 
studied by comparing the reliability of networks with 
double-ring and braid configurations. 

For this section and the next, the first step in com- 
puting reliability was to generate the list of minimal 
spanning trees for the networks. Because of the com- 
binatorial complexity of generating these lists, the 
accuracy of the results was checked by implementing 
two methods of tree generation (refs. 2 and 3). An 
additional check was made by using the previously 
mentioned formula (ref. 3) for computing the number 
of minimal spanning trees without generating them. 
In all the cases, the two lists of minimal spanning 
trees were identical, and the number of trees gen- 
erated was correct. After generating the minimal 
spanning trees, a fault tree based on the spanning 
trees was created in an acceptable input format and 
submitted to the Fault Tree Compiler program. 

Bidirectional networks configured as braids and 
double rings containing between five and nine nodes 
inclusive were studied. Limited computing capacity 
restricted network size to a maximum of nine nodes. 


4 



Probability of link failure was varied from 1CT 1 to 1()“ 5 . Table II contains the reliability results from the study 
of double-ring networks and table III contains the reliability results for the two-braid networks. 

In each case, the two-braid configuration is more reliable than the corresponding double ring. As the 
probability of failure of the links decreases by one order of magnitude, the probability of system failure decreases 
by four orders of magnitude regardless of the configuration or number of nodes in the network. Increasing the 
number of nodes in the network slightly decreased the reliability for both architectures. This effect seems 
reasonable since it is more difficult to keep a system fully connected as the number of nodes increases. 

Reliability When Nodes and Bidirectional Links Fail 

When both the links and the nodes are allowed to fail, two assumptions are made for a network to remain 
operational: (1) at least a strict majority of the nodes must be working and (2) all working nodes must be 
connected. These assumptions are made because they are simple and reasonable. A strict majority of good 
nodes can outvote the corrupt data from the failed nodes. The good nodes must be connected in order to work 
together. To study the effects of node and link failures, consider the braided six-plex pictured in figure 7. 

Success for this six-plex network requires that no more than two nodes fail, since there must be at least four 
working nodes to maintain a majority. The key to computing reliability for networks with both node and link 
failures is to consider a partition of the sample space based on the number of node failures. Figure 8 shows the 
five possible successful architectures for the network in figure 7. 


Table II. Reliability Results for Double-Ring Networks 
[L = Probability of link failure] 



Probability of system failure 

Number 
of nodes 

L = lfT 1 

CN 

1 

o 

H 

II 

L = 10“ 3 

TT 

1 

o 

r-H 

II 

L = 10“ 5 

5 

0.980150 x 10“ 3 

0.999800 xl0“ 7 

0.999998 x 10“ 11 

0.999410 xl0“ 15 

0.999941 x 10“ 19 

6 

1.46045 

1.49960 

1.49996 

1.50000 

1.50000 

7 

2.03104 

2.09912 

2.09999 

2.10000 

2.10000 

8 

2.69008 

2.79887 

2.79999 

2.80000 

2.80000 

9 

3.43573 

3.59832 

3.59998 

3.60000 

3.60000 


Table III. Reliability Results for Two-Braid Networks 
\L = Probability of link failure] 




Probability of system failure 


Number 
of nodes 

II 

H-* 

o 

t 

L = 10“ 2 

L = 10“ 3 

L = 10“ 4 

L = 10“ 5 

5 

5.07758 x 10“ 4 

5.00098 x 10“ 8 

5.00001 x 10“ 12 

5.00000 x 10“ 16 

5.00000 x 10“ 2 ° 

6 

6.13153 

6.00157 

6.00002 

6.00000 

6.00000 

7 

7.17702 

7.00205 

7.00002 

7.00000 

7.00000 

8 

8.13132 

8.00272 

7.99948 

7.99999 

8.00000 

9 

9.29784 

9.00018 

8.99919 

8.99999 

9.00000 
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(a) Zero failed nodes. 


Figure 7. Two- braided six-plex. 


Figure 8 depicts the possible architectures for 
a braided six-plex when a strict minority of nodes 
fail and the links attached to a failed node are 
no longer operational (and are removed from the 
diagram). There is only one architecture for zero 
failed nodes and one architecture for one failed node. 
The network is complex enough that there are three 
architectures possible when two nodes fail. The 
probability of each of these three architectures, given 
two failed nodes, is simply a ratio 

P{architecture 1, given two failed nodes} = 6/15 = 2/5 
P{ architecture II, given two failed nodes} = 6/15 = 2/5 
P { architecture III, given two failed nodes} = 3/15 = 1/5 

If the probability of a node failure is defined to be 
u, the probability that n out of six nodes will fail is 
given by the combinatorial formula 

f^)u n (l-w) 6 ~ rt 

where 


\ n ) n \( 6 — n)\ 



(b) One failed node. 



(c) Two failed nodes: architecture I. Adjacent nodes fail 
(six cases). 



(d) Two failed nodes: architecture II. Failed nodes separated 
by one node (six cases). 


The formula for computing network failure F 
using the partition on the number of node failures 
is 

O O 

P{F} = P{F , given zero fail} P{zero fail} 

+ P{F, given one fails} P{one fails} 

+ P{arch. I fails} P{arch. I, given two fail} P{two fail} 

+ /'{arch. II fails} P{arch. II, given two fail} P{two fail} (c) failed nodes: architecture III. Failed nodes separated 

by two nodes (three cases). 

+ P{arch. Ill fails} P{arch. Ill, given two fail} P{two fail} 

Figure 8. The five possible architectures for a two-braided 
-(- P{three or more fail} six-plex when links are removed because of node failures. 
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Figure 9 shows the probability of network failure 
for braids containing five to nine nodes, and figure 10 
shows corresponding double-ring computations. In 
this study, probability of link failure was held con- 
stant at 1(T 2 , and probability of node failure ranged 
from 10“ 1 to 1CT 4 . The data for figures 9 and 10 are 
presented in the appendix. 



Figure 9. Probability of network failure for two-braid 
networks. 


relatively high, since node failures would play a more 
prominent role in causing system failure. This strict 
majority phenomenon does not have much influence 
on the double-ring networks because a double-ring 
network will almost always fail from node failures 
long before a majority of nodes fail. For example, 
tw T o node failures will cause the failure of a double- 
ring network unless the two failed nodes are adjacent. 

Reliability When Unidirectional Links 
Fail 

For the systems discussed in this section, a link 
consists of a transmitter, a line, and a receiver. Mes- 
sages are sent in only one direction on each link. The 
criterion for network survival is that all the nodes 
be able to send and receive messages to each other. 
Unlike the minimal spanning sets for bidirectional 
networks, minimal spanning sets for unidirectional 
networks may contain minimal spanning trees with 
different numbers of elements. Consider the network 
in figure 11 and two of its minimal spanning trees 
pictured in figure 12. 


Probability of 



Figure 10. Probability of network failure for double-ring 

networks. 

The double-ring networks behave as expected; as 
the number of nodes increases, the probability of 
system failure slightly increases. The behavior of the 
two-braid networks, especially when the probability 
of node failure is large, is not as easily explained. 
Part of the variation can be attributed to requiring a 
strict majority of nodes to be operational for system 
survival. For instance, in the six-node networks, four 
nodes must be working for the system to survive. 
Four nodes are also needed for survival of seven- 
node networks. Thus, it is easier to have the strict 
majority of nodes working in networks with an odd 
number of nodes; hence, the probability of system 
failure decreases at these points. This decrease is 
more profound when the probability of node failure is 



Figure 11. A network with unidirectional links. 


A method for generating the list of spanning trees 
for a unidirectional network is to create a relational 
matrix from the description of the network and then 
compute reachability for each node in the network 
(ref. 4). Evaluating a fault tree patterned after these 
spanning sets, just as with the minimal spanning 
trees of previous sections, will result in network 
reliability figures. 

This study of unidirectional networks considered 
two-braid networks and double-ring networks con- 
taining five to seven nodes inclusive. Figure 13 
depicts four link arrangements in order of decreas- 
ing reliability. The most reliable network is the 
corotational double ring. The next most reliable is 
the corotational two braid, followed by the counter- 
rotational two braid. The least reliable is the 
count errotational double ring. Table IV gives the 
numerical results for the reliability of each of these 
architectures. 
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Corotational double-ring 


o ^ * o 

A 


t 



Figure 12. Two minimal spanning trees for the network in 
figure 11. 

As seen in the study of bidirectional links, in- 
creasing the number of nodes slightly increased the 
probability of failure. Among the configurations with 
the same number of nodes, the corotational ring con- 
figuration is the most reliable. Differences between 
the corotational and counterrotational braids were 
minute. And, in general, there was less than one or- 
der of magnitude difference in reliability among any 
of the networks. 

Table IV. Reliability Results for Networks With 
Unidirectional Links 



Corotational two-braid 



Number 
of nodes 

Network 

configuration 

Probability of 
system failure 

5 

Corotational ring 
Counterrotational ring 
Corotational braid 
Counterrotational braid 

0.499900 x 10“ 3 
1.94060 
0.989755 
0.989755 

6 

Corotational ring 
Counterrotational ring 
Corotational braid 
Counterrotational braid 

0.599850 x 10" 3 
2.88194 
1.18947 
1.19509 

7 

Corotational ring 
Counterrotational ring 
Corotational braid 
Counterrotational braid 

0.699790 x KT 3 
3.99465 
1.38538 
1.39843 



Counterrotational double-ring 

Figure 13. Four unidirectional link configurations. 
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Reliability With Faulty Links in 
Bidirectional Networks 

In the previous sections, links were viewed as ei- 
ther operative (sending correct messages) or , through 
failing, inoperative (failing to send any message). 
This section considers faulty links, which are links 
that fail by transmitting incorrect messages. In this 
case, the assumption is that system survival depends 
on the connectivity of the nodes and, additionally, 
on each node having a majority of good links. The 
idea of a faulty link, rather than absolute failure, may 
more realistically model the behavior of communica- 
tion links. 

In fault-tolerant computer systems, redundancy is 
a common technique used to achieve higher reliabil- 
ity. In networks, redundancy can be implemented on 
different levels. This section compares two methods 
of providing redundancy: link redundancy and path 
redundancy. 

In link redundancy the network is connected by a 
single path, where each segment of the path consists 
of redundant links. For example, if each segment 
consists of three links, then the segment fails if two 
or three of the links fail. If the probability of link 
failure is p, then the probability of segment failure s 
is 

s - 3p 2 (i -p) +p 3 

Figure 14(a) displays a ring where each segment 
between nodes consists of three links and each link 
has probability of failure p. Figure 14(b) displays the 
same ring, indicating just the segments where each 
segment has probability of failure s = 3p 2 (l -p) +p. 
Since this network fails if two or more segments fail, 
the probability of network failure is 


P{ network failure} = 1 - P{zero failed segments} 

- P{one failed segment} 

= 1 - (1 - sf - 6s(l - s) 5 

where s is the probability of segment failure given 
above. 

When using path redundancy, the links connect- 
ing two nodes can be considered as belonging to dif- 
ferent levels. Figure 15(a) displays three levels. The 
links in the first level are represented by solid lines, 
in the second level by dotted lines, and in the third 
level by broken lines. The links in each level attempt 
to form a minimal spanning tree. Different levels 
can have different spanning trees. Figure 15(b) dis- 
plays three different spanning trees for the links in 
figure 15(a). 



(a) Individual links. 


O 



(b) Links combined into segments. 

Figure 14. Link redundancy for a ring network with six nodes. 

When computing the reliability using path redun- 
dancy, the first step is to calculate the probability of 
having a spanning tree for each level. The second 
step is to calculate the probability that a majority 
of levels have a spanning tree. For the network in 
figure 15(a), a ring network with three levels, a level 
will not have a spanning tree if two or more links 
fail. If the probability of a link failure is p, then the 
probability of a “level” failure Q is 

Q = 1 - P{zero link failures} - P{one link failure} 
= 1 - (1 - p) 6 - 6p(l - p) 5 

The probability of network failure is the probability 
that two or three levels fail, which is 

P{F} = 3Q 2 {1 - Q) + Q 3 
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(a) Three-level six-plex. 

o 



(b) A spanning tree for each level of the three-level six-plex. 
Figure 15. Illustration of path redundancy. 

This issue of link redundancy versus path redun- 
dancy appears in the design of the Advanced In- 


formation Processing System (AIPS) (ref. 6). The 
baseline architecture of the AIPS network consists of 
three rings. Each ring has five nodes and two extra 
links connecting that ring to a computer. For the 
AIPS network to remain functional, at least two of 
the three rings must be connected. No analysis of 
path versus link redundancy is given, though, to jus- 
tify the choice of path redundancy. In fact, the study 
presented in this paper is the only known comparison 
of these two redundancy techniques. 

A comparison of link redundancy versus path 
redundancy was completed for two-braid networks 
and double-ring networks having six and seven nodes. 
Table V shows the probability of failure for these 
networks. 

Table V. Probability of Network Failure Using Link 
and Path Redundancy 


Probability of network failure 


Network 

Path 

Link 

configuration 

redundancy 

redundancy 

Triple redundancy 

Two braid, 6 nodes 

1.081 x 10 _H 

4.732 x 10“ 14 

Two braid, 7 nodes 

1.471 

5.520 

Double ring, 6 nodes 

6.746 

11.83 

Double ring, 7 nodes 

13.22 

16.56 

Fivefold redundancy 

Two braid, 6 nodes 

0.2162 x 10" 20 

5.649 x 10 _2 ° 

Two braid, 7 nodes 

0.3433 

6.591 

Double ring, 6 nodes 

3.372 

14.12 

Double ring, 7 nodes 

9.252 

19.77 


The table shows little difference in reliability be- 
tween link and path redundancy. Path redundancy 
gives slightly higher, but not significantly higher, reli- 
ability results for each network. Therefore, the choice 
of redundancy method would be governed by design 
convenience or performance considerations. 

Conclusions 

Despite the disadvantages of combinatorial meth- 
ods and the demanding computational requirements 
of network problems, using minimal spanning trees 
is an effective means of performing basic reliability 
analysis for small networks. Two network topics were 
examined using the minimal spanning tree approach 
and its generalization for directed networks. The 
first topic was an examination of network reliabil- 
ity when a link no longer delivered messages upon 
failure. For this case, the reliability of the popular 
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double-ring and braided networks was studied and 
comparisons were made for both bidirectional and 
unidirectional links. The braided networks exhibited 
higher reliability with bidirectional links, while some 
of the double-ring configurations, especially the co- 
rotational ring, showed better reliability with uni- 
directional links. With both types of network con- 
figuration, the reliability of the network slightly 
decreased as more nodes were added. 

The second topic was an examination of network 
reliability when a link delivered incorrect messages 
upon failure. For this case, the study compared the 
effects of link redundancy versus path redundancy on 
network reliability. Although path redundancy pro- 


duced higher reliability in each case, the reliability 
was only a slight improvement over link redundancy. 
Thus, other considerations such as performance or 
engineering restrictions should impact the choice of 
redundancy technique. This analysis has direct ap- 
plication to present fault-tolerant computer systems 
such as the Advanced Information Processing System 
(AIPS) that currently implements path redundancy 
to achieve network reliability. 


NASA Langley Research Center 
Hampton, VA 23665-5225 
July 23, 1990 
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Appendix 


Reliability Results for Node and Bidirectional Link Failure 

The following tables contain reliability figures for the various bidirectional network configurations which 
result when both links and nodes fail. The tables cover two braids and double rings containing between five 
and nine nodes. The probability of link failure is 10 -2 in all the tables. 


Five Nodes, Two Braid 


Number of 
failed nodes 

Architecture 

Number of 
links 

Number of minimal 
spanning trees 

Probability of 
system failure 

Probability of 
architecture 

0 


10 

125 

5.00098 x 10 -8 


1 


6 

16 

4.02881 x 10~ 6 


2 

1 

3 

3 

2.98000 x 10~ 4 

1/2 

2 

2 

3 

3 

2.98000 x 10~ 4 

1/2 


Probability of 
node failure 

Probability of 
system failure 

10- 1 

8.583075 x 10“ 3 

10 -2 

1.038081 x lO" 5 

10 -3 

8.277992 x 10~ 8 

lO^ 4 

5.203818 x 10 8 


Six Nodes, Two Braid 


Number of 
failed nodes 

Architecture 

Number of 
links 

Number of minimal 
spanning trees 

Probability of 
system failure 

Probability of 
architecture 

0 


12 

384 

6.00157 x 10" 8 


1 


8 

45 

4.04957 x 10- 6 


2 

1 

5 

8 

2.03910 x 10~ 4 

2/5 

2 

2 

5 

8 

2.03910 x 10~ 4 

2/5 

2 

3 

4 

4 

5.92030 x 10~ 4 

1/5 


Probability of 
node failure 

Probability of 
system failure 

10- 1 

1.587917 x 10~ 2 

10~ 2 

2.024682 x 10~ 5 

10~ 3 

1.079938 x 10^ 7 

10" 4 

6.247043 x 10~ 8 
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Seven Nodes, Two Braid 


Number of 
failed nodes 


0 

1 

2 

2 

2 

3 

3 

3 

3 


Architecture 


1 

2 

3 

1 

2 

3 

4 


Number of 
links 


14 

10 

7 

7 

6 

5 

4 

3 

4 


Number of minimal 
spanning trees 


1183 

130 

21 

24 

11 

8 

3 
1 

4 


Probability of 
system failure 


-8 

-6 


7.00207 x 10 
4.06017 x 10 
2.03988 x 10“ 4 
1.06007 x 10" 4 
4.03792 x 10“ 4 
2.03910 x 10~ 4 
1.02950 x 10 -2 
2.97010 x 10" 2 
5.92030 x 10“ 4 


Probability of 
architecture 


1/3 

1/3 

1/3 

1/5 

2/5 

1/5 

1/5 


Probability of 
node failure 

Probability of 
system failure 

10” 1 

2.993672 x 10 -3 

10 -2 

1.493146 x 10' 6 

10 -3 

1.031453 x 10" 7 

10 -4 

7.286241 x 10“ 8 


Eight Nodes, Two Braid 


Number of 
failed nodes 


0 

1 

2 

2 

2 

2 

3 

3 

3 

3 

3 


Architecture 


1 

2 

3 

4 
1 
2 

3 

4 

5 


Number of 
links 


16 

12 

9 

9 

8 

8 

7 

6 

5 

6 
5 


Number of minimal 
spanning trees 


3528 

368 

55 

66 

32 

30 

21 

8 

3 

11 

5 


Probability of 
system failure 


8.00272 

4.08037 

2.04988 

1.06029 

3.05946 

3.07848 

2.03988 

1.02019 

2.01921 

4.03792 

9.80150 


x 10~ 8 
x 10" 6 
x 10“ 4 
x 10~ 4 
x 10~ 4 
x 10~ 4 
x 10 -4 


Probability of 
architecture 


2/7 

2/7 

2/7 

1/7 

1/7 

2/7 

2/7 

1/7 

1/7 


Probability of 
node failure 

Probability of 
system failure 

10 _1 

5.353379 x 10~ 3 

10“ 2 

2.111147 x 10“ 6 

10“ 3 

1.185008 x 10“ 7 

10“ 4 

8.328735 x 10~ 8 






Nine Nodes, Two Braid 


Number of 
failed nodes 

Architecture 

Number of 
links 

Number of minimal 
spanning trees 

Probability of 
system failure 

Probability of 
architecture 

0 


18 

10 404 

9.00018 x 10" 8 


1 


14 

1 040 

4.10057 x 10" 6 


2 

1 

11 

144 

2.05998 x 10“ 4 

1/4 

2 

2 

11 

185 

1.06049 x 10~ 4 

1/4 

2 

3 

10 

87 

3.05968 x 10~ 4 

1/4 

2 

4 

10 

8 

2.09955 x 10“ 4 

1/4 

3 

1 

9 

55 

2.04988 x 10 -4 

3/28 

3 

2 

8 

21 

1.02019 x 10“ 2 

3/14 

3 

3 

7 

8 

2.00999 x 10~ 2 

3/14 

3 

4 

7 

9 

1.05899 x 10~ 2 

3/28 

3 

5 

8 

32 

3.05946 x 10~ 4 

3/28 

3 

6 

7 

14 

6.99656 x 10 -4 

3/14 

3 

7 

6 

6 

1.46045 x 10 -3 

1/28 

i 4 

1 

7 

21 

2.03988 x 10~ 4 

1/14 

4 

2 

6 

8 

1.02019 x 10“ 2 

1/7 

4 

3 

5 

0 

1.00000 x 10° 

1/14 

4 

4 

5 

3 

2.01921 x 10~ 2 

2/7 

4 

5 

4 

0 

1.00000 x 10° 

1/14 

4 

6 

5 

3 

2.01921 x 10~ 2 

1/14 

4 

7 

4 

1 

3.94040 x 10~ 2 

3/14 

4 

8 

5 

5 

9.80150 x 10“ 4 

1/14 


Probability of 
node failure 

Probability of 
system failure 

10 _1 

2.47101 x 10“ 3 

10 -2 

1.94486 x 10 -6 

10 -3 

1.33884 x 10“ 7 

10~ 4 

9.36835 x 10 -8 
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Five Nodes, Double Ring 



Probability of 
node failure 

Probability of 
system failure 

KT 1 

4.511575 x 1(T 2 

10“ 2 

5.095997 x 10~ 4 

10~ 3 

6.589337 x 10“ 6 

10“ 4 

2.998600 x 10" 7 


Six Nodes, Double Ring 


Number of 
failed nodes 

Architecture 

Number of 
links 

Number of minimal 
spanning trees 

Probability of 
system failure 

Probability of 
architecture 

0 


12 

192 

1.49960 x 10“ 7 


1 


8 

16 

3.99940 x 10~ 4 


2 

1 

6 

8 

2.99970 x 10~ 4 

2/5 

2 

2 

4 

0 

1.00000 x 10° 

2/5 

9 

3 

4 

0 

1.00000 x 10° 

1/5 


Probability of 
node failure 

Probability of 
system failure 

10" 1 

7.505259 x 10“ 2 

10 -2 

9.072244 x 10 -4 

10 -3 

1.152253 x 10~ 5 

10“ 4 

4.797161 x 10“ 7 
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Seven Nodes, Double Ring 


Number of 
failed nodes 

Architecture 

Number of 
links 

Number of minimal 
spanning trees 

Probability of 
system failure 

Probability of 
architecture 

0 


14 

448 

2.09912 x 10“ 7 


1 


10 

32 

4.99900 x 10“ 4 


2 

1 

8 

16 

3.99940 x 10“ 4 

1/3 

2 

2 

6 

0 

1.00000 x 10° 

1/3 

2 

3 

6 

0 

1.00000 x 10° 

1/3 

3 

1 

6 

8 

2.99970 x 10“ 4 

1/5 

3 

2 

4 

0 

1.00000 x 10° 

2/5 

3 

3 

4 

0 

1.00000 x 10° 

1/5 

3 

4 

2 

0 

1.00000 x 10° 

1/5 


Probability of 
node failure 

Probability of 
system failure 

10“ ! 

1.03963 x 10“ 1 

10“ 2 

1.39190 x 10“ 3 

10“ 3 

1.76462 x 10“ 5 

10“ 4 

6.99457 x 10“ 7 


Eight Nodes, Double Ring 


Number of 
failed nodes 

Architecture 

Number of 
links 

Number of minimal 
spanning trees 

Probability of 
system failure 

Probability of 
architecture 

0 


16 

1024 

2.79887 

X 

10“ 7 


1 


12 

64 

5.99850 

X 

10“ 4 


2 

1 

10 

32 

4.99900 

X 

10~ 4 

2/7 

2 

2 

8 

0 

1.00000 

X 

10° 

2/7 

2 

3 

8 

0 

1.00000 

X 

10° 

2/7 

2 

4 

8 

0 

1.00000 

X 

10° 

1/7 

3 

1 

8 

16 

3.99940 

X 

10~ 4 

1/7 

3 

2 

6 

0 

1.00000 

X 

10° 

2/7 

3 

3 

6 

0 

1.00000 

X 

10° 

2/7 

3 

4 

4 

0 

1.00000 

X 

10° 

1/7 

3 

5 

4 

0 

1.00000 

X 

10° 

1/7 


Probability of 
node failure 

Probability of 
system failure 

10 _1 

1.39908 x 10“ 1 

10 -2 

1.97465 x 10 -3 

10~ 3 

2.49751 x 10~ 5 

10“ 4 

9.59175 x 10" 7 
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Nine Nodes, Double Ring 


Architecture 


Number of 
links 

Number of minimal 
spanning trees 

Probability of 
system failure 

Probability 

architectui 

18 

2304 

3.59832 x 10“ 7 


14 

128 

6.99790 x 10“ 4 


12 

64 

5.99850 x 10“ 4 

1/4 

10 

0 

1.00000 x 10° 

1/4 

10 

0 

1.00000 x 10° 

1/4 

10 

0 

1.00000 x 10° 

1/4 

10 

32 

4.99900 x 10“ 4 

3/28 

8 

0 

1.00000 x 10° 

3/14 

8 

0 

1.00000 x 10° 

3/14 

8 

0 

1.00000 x 10° 

3/28 

6 

0 

1.00000 x 10° 

3/28 

6 

0 

1.00000 x 10° 

3/14 

6 

0 

1.00000 X 10° 

1/28 

8 

16 

3.99940 x 10 4 

1/14 

6 

0 

1.00000 x 10° 

1/7 

6 

0 

1.00000 x 10° 

1/14 

6 

0 

1.00000 x 10° 

2/7 

6 

0 

1.00000 x 10° 

1/14 

4 

0 

1.00000 x 10° 

1/14 

4 

0 

1.00000 x 10° 

3/14 

2 

0 

1.00000 X 10° 

1/14 


Probability of 
node failure 

Probability of 
system failure 

10 -1 

1.77097 x 10“ 1 

10“ 2 

2.64726 x 10“ 3 

10“ 3 

3.49611 x 10“ 5 

10“ 4 

1.25876 x 10“ 6 
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